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EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Sliould tlie 
clianges and/or additions be unacceptable to applicant, an amendment may be 
filed as provided by 37 CFR 1 .312. To ensure consideration of such an 
amendment, it MUST be submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone 
interview with Joshua D. Mather on 05/05/2009. 

2. The application has been amended as follows: 

3. Claims 16, 20-23, 28, 29, 33, 36, 37, 41, 42 and 49 has been canceled. 

• Claim 1 . (Currently Amended) A method for gathering and 
monitoring the simultaneous status of nodes in a storage area 
network (SAN), comprising: 

receiving alert messages corresponding to status events in the 
storage area network, each status event having a corresponding event 
category and severity value, the storage area network having nodes that 
include manageable entities, the manageable entities responsive to a 
server in the storage area network, the nodes including storage entities, 
connectivity entities, and database entities : 

aggregating the alert messages according to event category and 
severity value to generate a category specific severity ranking of the alert 
messages; 

displaying a status array having a plurality of chart entries, each 
chart entry corresponding to alert messages of a particular event category 
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and each chart entry having a node entry for each node having status 
attributable to the alert messages, the status array is an N by M matrix of 
the plurality of chart entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network: 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network: 

iii) a host chart entry indicating alert status of managed host entities 
in the storage area network: and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network; 

receiving a selection of at least one node in the N by M status array 
matrix of the plurality of chart entries: 

displaying the status array including simultaneously listing, for each 
category type, nodes having status events of greatest severity: 

displaying, within at least one chart entry, node entries in relation to 
the selected at least one node in order to display the simultaneous status 
of nodes in the storage area network: and 

displaying, within at least one chart entry, node entries having a 
status event associated with the event category for that chart entry, the 
node entries displayed in the chart entry according to the severity ranking 
and each node entry indicative of a severity scale of status for the 
corresponding effected node. 
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• Claim 2. (Previously Presented) The method of claim 1 wherein 
displaying, within the at least one chart entry, comprises: 

accumulating events of each of a plurality of severity levels, 
each severity level representing a range of severity values such 
that a given status event with a given severity value has a 
corresponding severity level when the given severity value of the 
given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node 
entry is an enumeration of events received for each of the plurality 
of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry; 

displaying the enumeration of events received for each node 
entry within the at least one chart entry containing that node entry, 
the enumeration of events received being displayed in an order 
according to the severity ranking; and 

wherein the alert messages are received from remote agents 
operating within a storage area network. 

• Claim 3. (Original) The method of claim 2 wherein the enumeration 
is a histogram having a magnitude based on the severity scale and 
a quantity of events within each severity level within the severity 
ranking. 

• Claim 4. (Original) The method of claim 3 wherein the histogram 
has a plurality of visually overlapping elongated bar segments. 
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each elongated bar segment corresponding to a particular severity 
level. 

• Claim 5. (Original) The method of claim 1 further including 
discovering a topology of nodes in the SAN, wherein the alert 
messages correspond to status events for each of a plurality of 
selected nodes in a selection tree, the selection tree indicative of 
the nodes in the SAN. 

• Claim 6. (Original) The method of claim 1 further including filtering 
the status events to compute a subset of elected events, wherein 
the received events correspond to elected events determined in 
response to predetermined filtering logic at the agents processing 
the elected events. 

• Claim 7. (Original) The method of claim 1 wherein each chart entry 
has a magnitude axis, the magnitude axis indicative of a relative 
range of the quantity of status events within each of the severity 
levels corresponding to a plurality of node entries reflected in the 
chart entry. 

• Claim 8. (Previously Presented) The method of claim 1 wherein 
each chart entry has a manageable entity axis, the manageable 
entity axis arranged, for each node, according to increasing severity 
scale denoting the severity ranking for each node included in the 
chart entry, and further comprising computing the severity scale for 
each node according to a predetermined severity metric. 



Application/Control Number: 10/674,322 Page 6 

Art Unit: 2452 

• Claim 9. (Original) The method of claim 1 wherein the severity level 
corresponds to a threshold value, the threshold value identifying 
triggering of an event having the corresponding severity level. 

• Claim 10. (Original) The method of claim 1 wherein each event in 
an event category has a set of threshold values, the threshold 
values indicative of a quantitative metric triggering the particular 
event and severity. 

• Claim 1 1 . (Original) The method of claim 1 0 further comprising 
processing and propagating the threshold values to remote agents, 
the remote agents operable to analyze nodes and determine when 
a particular metric satisfying a triggering threshold is attained and 
generate the corresponding event. 

• Claim 12. (Original) The method of claim 1 wherein the nodes 
further comprise manageable entities, the manageable entities 
responsive to the server in a SAN and further including storage 
entities, connectivity entities, and database entities. 

• Claim 13. (Original) The method of claim 1 further comprising 
selectively suppressing events of a particular category and severity. 

• Claim 14. (Original) The method of claim 1 wherein the chart 
entries in the status array are further subdivided into chart entries 
directed to manageable entity health, manageable entity 
performance, and storage system capacity. 

• Claim 15. (Original) The method of claim 1 comprising: 
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receiving a selection of at least one node in a hierarchical 
arrangement of nodes; and 

wherein receiving, aggregating, displaying a status array, and 
displaying, within at least one chart entry, node entries are performed 
in relation to the selected at least one node in order to display the 
simultaneous status of nodes in a storage area network. 

• Claim 17. (Original) The method of claim 1 further comprising 

receiving a user input corresponding to selection of at 
least one node entry from among the node entries displayed 
in the status array; 

displaying an expanded menu of status options for the 
selected entry; and 

receiving a response to the menus of status options and 
displaying an expanded status report corresponding to the 
expanded menu. 

• Claim 1 8. (Currently Amended) A network monitoring device for 
gathering and monitoring the simultaneous status of nodes in a 
storage area network (SAN), comprising: 

a server having a correlator operable to receive alert messages 
corresponding to status events in the storage area network, each 
status event having a corresponding event category and severity 
value, the storage area network having nodes that include 
manageable entities, the manageable entities responsive to a 
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server in the storage area network, the nodes including storage 
entities, connectivity entities, and database entities : 

an aggregator operable to aggregate the alert messages 
according to event category and severity value to generate a 
category specific severity ranking of the alert messages; and 

an operator console operable to display a status array 
having a plurality of chart entries, each chart entry corresponding to 
alert messages of a particular event category and each chart entry 
having a node entry for each node having status attributable to the 
alert messages, the status array is an N by M matrix of the plurality 
of chart entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of 
managed entities in the storage area network: 

ii) a storage chart entry indicating alert status of managed 
storage entities in the storage area network: 

iii) a host chart entry indicating alert status of managed host 
entities in the storage area network: and 

iv) a connectivity chart entry indicating alert status of 
managed connectivity entities in the storage area network: 

the console further operable to receive a selection of at least 
one node in the N by M status array matrix of the plurality of chart 
entries, display the status array including simultaneously listing, for 
each category type, nodes having status events of greatest 
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severity, and display, within at least one chart entry, node entries in 
relation to the selection of at least one node in order to display the 
simultaneous status of nodes in the storage area network; and 

the console further operable to display, within at least one chart 
entry, node entries haying a status event associated with the event 
category for that chart entry, the node entries displayed in the chart 
entry according to the severity ranking and each node entry 
indicative of a severity scale of status for the corresponding 
effected node. 

• Claim 19. (Previously Presented) The network monitoring device of 
claim 18 wherein the accumulator is further operable to: 

accumulate events of each of a plurality of severity levels, each 
severity level representing a range of severity values such that a 
given status event with a given severity value has a corresponding 
severity level when the given severity value of the given status 
event is within a range of severity values for the corresponding 
severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity 
levels within the severity ranking, the severity ranking determined 
by the severity scale for each node entry; 

display, within the at least one chart entry, the enumeration of 
events received for each node entry within the at least one chart 
entry containing that node entry, the enumeration of events 
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received being displayed in an order according to the severity 
ranl<ing; 

wherein the enumeration is a histogram having a magnitude 
based on the severity scale and a quantity of events within each 
severity level within the severity ranking; and 

wherein the histogram has a plurality of visually overlapping 
elongated bar segments, each elongated bar segment 
corresponding to a particular severity level. 

• Claim 24. (Original) The network monitoring device of claim 18 
wherein each chart entry has a magnitude axis, the magnitude axis 
Indicative of a relative range of the quantity of status events within 
each of the severity levels corresponding to a plurality of node 
entries reflected in the chart entry. 

• Claim 25. (Previously Presented) The network monitoring device of 
claim 18 wherein each chart entry has a manageable entity axis, 
the manageable entity axis arranged, for each node, according to 
increasing severity scale denoting the severity ranking for each 
node included in the chart entry, and further comprising computing 
the severity scale for each node according to a predetermined 
severity metric. 

• Claim 26. (Original) The network monitoring device of claim 18 
wherein the severity level corresponds to a threshold value, the 
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threshold value identifying triggering of an event having the 
corresponding severity level. 

• Claim 27. (Currently Amended) The network monitoring device of 
claim 18 wherein each event in an event category has a set of 
threshold values, the threshold values indicative of a quantitative 
metric triggering the particular event and severity; and 

wherein the server is further operable to processing and 
propagating the threshold values to remote agents, the remote 
agents operable to analyze nodes and determine when a particular 
metric satisfying a triggering threshold is attained and generate the 
corresponding event. 

• Claim 30. (Original) The network monitoring device of claim 18 
wherein the server is operable to selectively suppress events of a 
particular category and severity. 

• Claim 31 . (Original) The network monitoring device of claim 18 
wherein the chart entries in the status array are further subdivided 
into chart entries directed to manageable entity health, manageable 
entity performance, and storage system capacity. 

• Claim 32. (Original) The network monitoring device of claim 18 
wherein the server is further operable to receive a selection of at 
least one node in a hierarchical arrangement of nodes, and display, 
within at least one chart entry, node entries in relation to the 
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selected at least one node in order to display the simultaneous 
status of nodes in a storage area network. 

• 34. (Original) The network monitoring device of claim 1 8 wherein 
the server is further operable to: 

receive a user input corresponding to selection of at least 
one node entry from among the node entries displayed in the status 
array; 

display an expanded menu of status options for the selected 
entry; and 

display an expanded status report corresponding to the 
expanded menu and a response to the menu of status options. 

• 35. (Currently Amended) A computer program product having a 
computer readable medium operable to store computer program 
logic embodied in computer program code encoded thereon for 
gathering and monitoring the simultaneous status of nodes in a 
storage area network (SAN), comprising: 

computer program code for receiving alert messages 
corresponding to status events in the storage area network, each 
status event having a corresponding event category and severity 
value, the storage area network having nodes that Include 
manageable entities, the manageable entities responsive to a 
server in the storage area network, the nodes including storage 
entities, connectivity entities, and database entities : 
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computer program code for aggregating the alert messages 
according to event category and severity value to generate a 
category specific severity ranking of tiie alert messages; 

computer program code for displaying a status array having 
a plurality of chart entries, each chart entry corresponding to alert 
messages of a particular event category and each chart entry 
having a node entry for each node having status attributable to the 
alert messages, the status array is an N by M matrix of the plurality 
of chart entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of 
managed entities in the storage area network; 

ii) a storage chart entry indicating alert status of managed 
storage entities in the storage area network: 

ill) a host chart entry indicating alert status of managed host 
entities in the storage area network: and 

iv) a connectivitv chart entry indicating alert status of 
managed connectivitv entities in the storage area network; 

computer program code for receiving a selection of at least 
one node in the N bv M status array matrix of the plurality of chart 
entries; 

computer program code for displaying the status array 
including simultaneously listing, for each category type, nodes 
having status events of greatest severity; 
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computer program code for displaying, within at least one 
chart entry, node entries in relation to the selected at least one 
node in order to display the simultaneous status of nodes in the 
storage area network : and 

computer program code for displaying, within at least one 
chart entry, node entries having a status event associated with the 
event category for that chart entry, the node entries displayed in the 
chart entry according to the severity ranking and each node entry 
indicative of a severity scale of status for the corresponding 
effected node. 

• Claim 38. (Previously Presented) The method of claim 1 , wherein 
the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each 
node entry for a given sampling interval, wherein each node entry is 
weighted with respect to a corresponding severity level for each 
alert message, each severity level representing a range of severity 
values such that a given status event with a given severity value 
has a corresponding severity level when the given severity value of 
the given status event is within a range of severity values for the 
corresponding severity level. 

• Claim 39. (Previously Presented) The network monitoring device of 
claim 18, wherein the severity scale for each node entry is an 
aggregate value representative of a number of alert messages 
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received at each node entry for a given sampling interval, wherein 
each node entry Is weighted with respect to a corresponding 
severity level for each alert message, each severity level 
representing a range of severity values such that a given status 
event with a given severity value has a corresponding severity level 
when the given severity value of the given status event is within a 
range of severity values for the corresponding severity level. 

• Claim 40. (Previously Presented) The computer program product 
of claim 35, wherein the severity scale for each node entry is an 
aggregate value representative of a number of alert messages 
received at each node entry for a given sampling Interval, wherein 
each node entry is weighted with respect to a corresponding 
severity level for each alert message, each severity level 
representing a range of severity values such that a given status 
event with a given severity value has a corresponding severity level 
when the given severity value of the given status event Is within a 
range of severity values for the corresponding severity level. 

• Claim 43. (Currently Amended) A method for gathering and 
monitoring the simultaneous status of nodes in a storage area 
network (SAN), comprising: 

discovering a topology of nodes in the SAN, wherein the 
nodes comprise manageable entities, the manageable entities 
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responsive to a server in the SAN and furtlier including storage 
entities, connectivity entities, and database entities; 

propagating threshold values to remote agents, wherein 
responsive to the threshold values, the remote agents operable to 
analyze nodes and determine when a particular metric satisfying a 
triggering threshold is attained, and to generate a corresponding 
status event as an alert message; 

receiving alert messages, from the remote agents, 
corresponding to status events in the storage area network, each 
status event having a corresponding event category and severity 
value; 

storing status events in an event repository; 

aggregating the alert messages according to event category 
and severity value to generate a category specific severity ranking 
of the alert messages; 

displaying a status array having a plurality of chart entries, 
each chart entry corresponding to alert messages of a particular 
event category and each chart entry having a node entry for each 
node having status attributable to the alert messages, the status 
array Is an N by M matrix of the pluralitv of chart entries, the 
plurality of chart entries including: 

i) a general alert chart entry displaying alert status of 
managed entities in the storage area network: 



Application/Control Number: 10/674,322 Page 17 

Art Unit: 2452 

ii) a storage chart entry indicating alert status of managed 
storage entities in tlie storage area networl<: 

ill) a host chart entry indicating alert status of managed host 
entities In the storage area network; and 

iy) a connectiyity chart entry indicating alert status of 
managed connectiyity entities in the storage area network: 

displaying the status array including simultaneously listing, 
for each category type, nodes haying status eyents of greatest 
seyerity: 

displaying, within at least one chart entry, node entries in 
relation to the selected at least one node In order to display the 
simultaneous status of nodes in the storage area network: and 

displaying, within at least one chart entry, node entries 
haying a status eyent associated with the eyent category for that 
chart entry, the node entries displayed In the chart entry according 
to the seyerity ranking and each node entry Indlcatlye of a seyerity 
scale of status for the corresponding effected node, wherein the 
seyerity scale for a node entry is an enumeration of eyents receiyed 
for each of a plurality of seyerity leyels with the seyerity ranking. 
• Claim 44. (Previously Presented) The method of claim 43 wherein 
the chart entries in the status array are further subdivided Into chart 
entries directed to manageable entity health, manageable entity 
performance, and storage system capacity; and 
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in response to a user request, the remote agents selectively 
suppressing events of a particular category and severity. 

• Claim 45. (Previously Presented) The method of claim 4, wherein 
displaying the enumeration of events includes displaying a 
histogram bar, for each node entry, that has a length proportional to 
a total number of status events corresponding to a node of the 
node entry. 

• Claim 46. (Previously Presented) The method of claim 45, wherein 
displaying the enumeration of events includes displaying each 
elongated bar segment indicating a quantity of status events 
corresponding to a corresponding severity level. 

• Claim 47. (Previously Presented) The method of claim 46, wherein 
each histogram bar has a maximum range that adjusts depending 
on a length of each histogram bar. 

• Claim 48. (Previously Presented) The method of claim 7, wherein 
the magnitude axis of each chart entry has a maximum range that 
adjusts depending on a maximum value of the severity levels. 

• Claim 50. (Previously Presented) The method of claim 43, further 
comprising: 

accumulating events of each of a plurality of severity levels, 
each severity level representing a range of severity values such 
that a given status event with a given severity value has a 
corresponding severity level when the given severity value of the 
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given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node 
entry is an enumeration of events received for each of the plurality 
of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry; 

propagating threshold values to remote agents, wherein 
responsive to the threshold values, the remote agents operable to 
analyze nodes and determine when a particular metric satisfying a 
triggering threshold is attained, and to generate a corresponding 
status event as an alert message; and 

in response to a user request, the remote agents 
selectively suppressing events of a particular category and severity. 
• Claim 51 . (Previously Presented) The method of claim 50, wherein 
the enumeration is a histogram having a magnitude based on the 
severity scale and a quantity of events within each severity level 
within the severity ranking; and 

wherein each chart entry has a manageable entity histogram 
bar, the manageable entity histogram bar arranged, for each node, 
according to increasing severity scale denoting the severity ranking 
for each node included in the chart entry, and further comprising 
computing the severity scale for each node according to a 
predetermined severity metric. 
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• Claim 52. (Previously Presented) The method of claim 51 , wherein 
each event in an event category has a set of threshold values, the 
threshold values indicative of a quantitative metric triggering the 
particular event and severity; and 

further comprising processing and propagating the threshold 
values to remote agents, the remote agents operable to analyze 
nodes and determine when a particular metric satisfying a 
triggering threshold is attained and generate the corresponding 
event. 

Allowable Subject Matter 

4. The following is an examiner's statement of reasons for allowance: 

Prior art singly or in combination fails to teach claim limitation, among 
other things, the combination of the status array is an N by M matrix of the 
plurality of chart entries, the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in 
the storage area network; 

ii) a storage chart entry indicating alert status of managed storage entities 
in the storage area network; 

ill) a host chart entry indicating alert status of managed host entities in the 
storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network; and 
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displaying the status array including simultaneously listing, for each 
category type, nodes having status events of greatest severity; and 

displaying, within at least one chart entry, node entries in relation to the 
selected at least one node in order to display the simultaneous status of nodes in 
the storage area network. 

• Claims 2-1 5, 1 7, 1 9, 24-27, 30-32, 34, 38-40 and 44-52 carry 
dependency from base claims 1 , 18, 35 and 44, which further limits 
the base claims. 

Any comments considered necessary by applicant must be submitted no 
later than the payment of the issue fee and, to avoid processing delays, should 
preferably accompany the issue fee. Such submissions should be clearly labeled 
"Comments on Statement of Reasons for Allowance." 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 

applicant's disclosure. 

Luo et al, Patent Number US 7,139,819 B1. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to TAUQIR HUSSAIN whose telephone number 
is (571)270-1247. The examiner can normally be reached on 7:30 AM to 5:00 
PM. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, John Follansbee can be reached on 571 272 3964. The 
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fax phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786- 
9199 (IN USA OR CANADA) or 571-272-1000. 

/T. H./ /Dohm Chankong/ 

Examiner, Art Unit 2452 Primary Examiner, Art Unit 2452 



